SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks

Two chained zero-day vulnerabilities in SonicWall's SMA1000 remote access gateways are being actively exploited, enabling unauthenticated remote code execution — one of the most severe threat profiles possible. Because these are zero-days, defenders had no advance warning, making rapid detection and emergency patching capabilities critical. Internet-facing VPN and remote access appliances are high-value targets because compromising them can grant attackers a foothold into the entire internal network. Organizations that lack a tested emergency patching workflow or real-time vulnerability visibility on perimeter devices are especially exposed. The availability of hotfixes means the window to remediate is open now, but every hour of delay increases risk.